when I starting it up this what I get in the log:
[2020-04-23T17:40:11,997][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.6.2"}
[2020-04-23T17:40:18,426][INFO ][org.reflections.Reflections] Reflections took 719 ms to scan 1 urls, producing 20 keys and 40 values
[2020-04-23T17:40:19,851][INFO ][logstash.filters.geoip ][03-secure] Using geoip database {:path=>"/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-6.0.3-java/vendor/GeoLite2-City.mmdb"}
[2020-04-23T17:40:20,582][WARN ][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge][01-beats-input] A gauge metric of an unknown type (org.jruby.RubyArray) has been created for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[2020-04-23T17:40:20,626][INFO ][logstash.javapipeline ][01-beats-input] Starting pipeline {:pipeline_id=>"01-beats-input", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/01-beats-input.conf"], :thread=>"#<Thread:0x2ab6d347@/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:37 run>"}
[2020-04-23T17:40:21,724][WARN ][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge][02-local-syslog-input] A gauge metric of an unknown type (org.jruby.RubyArray) has been created for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[2020-04-23T17:40:21,757][WARN ][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge][03-secure] A gauge metric of an unknown type (org.jruby.RubyArray) has been created for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[2020-04-23T17:40:21,857][INFO ][logstash.javapipeline ][03-secure] Starting pipeline {:pipeline_id=>"03-secure", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/03-secure.conf"], :thread=>"#<Thread:0x6409860 run>"}
[2020-04-23T17:40:21,855][INFO ][logstash.javapipeline ][02-local-syslog-input] Starting pipeline {:pipeline_id=>"02-local-syslog-input", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/02-local-syslog-input.conf"], :thread=>"#<Thread:0x56f4b17d@/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38 run>"}
[2020-04-23T17:40:23,294][INFO ][logstash.outputs.elasticsearch][30-elasticsearch-output] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://il-infra-es-stg1:9200/, https://il-infra-es-stg2:9200/, https://il-infra-es-stg3:9200/]}}
[2020-04-23T17:40:23,970][INFO ][logstash.javapipeline ][03-secure] Pipeline started {"pipeline.id"=>"03-secure"}
[2020-04-23T17:40:24,015][INFO ][logstash.javapipeline ][02-local-syslog-input] Pipeline started {"pipeline.id"=>"02-local-syslog-input"}
[2020-04-23T17:40:24,039][INFO ][logstash.inputs.beats ][01-beats-input] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2020-04-23T17:40:24,272][WARN ][logstash.outputs.elasticsearch][30-elasticsearch-output] Restored connection to ES instance {:url=>"https://il-infra-es-stg1:9200/"}
[2020-04-23T17:40:24,354][INFO ][logstash.outputs.elasticsearch][30-elasticsearch-output] ES Output version determined {:es_version=>7}
[2020-04-23T17:40:24,371][WARN ][logstash.outputs.elasticsearch][30-elasticsearch-output] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2020-04-23T17:40:24,467][WARN ][logstash.outputs.elasticsearch][30-elasticsearch-output] Restored connection to ES instance {:url=>"https://il-infra-es-stg2:9200/"}
[2020-04-23T17:40:24,548][WARN ][logstash.outputs.elasticsearch][30-elasticsearch-output] Restored connection to ES instance {:url=>"https://il-infra-es-stg3:9200/"}
[2020-04-23T17:40:24,571][INFO ][logstash.javapipeline ][01-beats-input] Pipeline started {"pipeline.id"=>"01-beats-input"}
[2020-04-23T17:40:24,620][INFO ][logstash.outputs.elasticsearch][30-elasticsearch-output] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//il-infra-es-stg1:9200", "//il-infra-es-stg2:9200", "//il-infra-es-stg3:9200"]}
[2020-04-23T17:40:24,677][INFO ][org.logstash.beats.Server][01-beats-input] Starting server on port: 5044
[2020-04-23T17:40:24,820][WARN ][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge][30-elasticsearch-output] A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been created for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[2020-04-23T17:40:24,823][INFO ][logstash.javapipeline ][30-elasticsearch-output] Starting pipeline {:pipeline_id=>"30-elasticsearch-output", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/30-elasticsearch-output.conf"], :thread=>"#<Thread:0x3908cf73@/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:37 run>"}
[2020-04-23T17:40:24,818][INFO ][logstash.outputs.elasticsearch][30-elasticsearch-output] Using default mapping template
[2020-04-23T17:40:24,897][INFO ][logstash.javapipeline ][30-elasticsearch-output] Pipeline started {"pipeline.id"=>"30-elasticsearch-output"}
[2020-04-23T17:40:24,949][INFO ][logstash.outputs.elasticsearch][30-elasticsearch-output] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2020-04-23T17:40:24,950][INFO ][logstash.agent ] Pipelines running {:count=>4, :running_pipelines=>[:"30-elasticsearch-output", :"03-secure", :"01-beats-input", :"02-local-syslog-input"], :non_running_pipelines=>[]}
[2020-04-23T17:40:25,216][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
when i shut it down I get :
[2020-04-23T17:44:23,428][WARN ][logstash.runner ] SIGTERM received. Shutting down.
[2020-04-23T17:44:28,637][WARN ][org.logstash.execution.ShutdownWatcherExt] {"inflight_count"=>0, "stalling_threads_info"=>{"other"=>[{"thread_id"=>55, "name"=>"[02-local-syslog-input]<pipeline", "current_call"=>"[...]/logstash-core/lib/logstash/plugins/builtin/pipeline/input.rb:26:in `sleep'"}], ["LogStash::Filters::Grok", {"match"=>{"message"=>"%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\\[%{POSINT:syslog_pid}\\])?: %{GREEDYDATA:syslog_message}"}, "id"=>"53f199b8b62701aff987cb6774a744a4d817400884bbb77131181a98b7214fc5", "pattern_definitions"=>{"GREEDYMULTILINE"=>"(.|\\n)*"}, "remove_field"=>"message"}]=>[{"thread_id"=>42, "name"=>"[02-local-syslog-input]>worker0", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>43, "name"=>"[02-local-syslog-input]>worker1", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>44, "name"=>"[02-local-syslog-input]>worker2", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>46, "name"=>"[02-local-syslog-input]>worker3", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}]}}
[2020-04-23T17:44:28,650][ERROR][org.logstash.execution.ShutdownWatcherExt] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.
[2020-04-23T17:44:28,676][WARN ][org.logstash.execution.ShutdownWatcherExt] {"inflight_count"=>0, "stalling_threads_info"=>{"other"=>[{"thread_id"=>72, "name"=>"[30-elasticsearch-output]<pipeline", "current_call"=>"[...]/logstash-core/lib/logstash/plugins/builtin/pipeline/input.rb:26:in `sleep'"}, {"thread_id"=>68, "name"=>"[30-elasticsearch-output]>worker0", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>69, "name"=>"[30-elasticsearch-output]>worker1", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>70, "name"=>"[30-elasticsearch-output]>worker2", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>71, "name"=>"[30-elasticsearch-output]>worker3", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}]}}
[2020-04-23T17:44:28,680][WARN ][org.logstash.execution.ShutdownWatcherExt] {"inflight_count"=>0, "stalling_threads_info"=>{"other"=>[{"thread_id"=>52, "name"=>"[03-secure]<pipeline", "current_call"=>"[...]/logstash-core/lib/logstash/plugins/builtin/pipeline/input.rb:26:in `sleep'"}], ["LogStash::Filters::GeoIP", {"source"=>"[system][auth][ssh][ip]", "target"=>"[system][auth][ssh][geoip]", "id"=>"b8a759950e37876f3486ca577996003b539fbe1386da618389faf20d7e1feade"}]=>[{"thread_id"=>45, "name"=>"[03-secure]>worker0", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>47, "name"=>"[03-secure]>worker1", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>48, "name"=>"[03-secure]>worker2", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>49, "name"=>"[03-secure]>worker3", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}]}}
[2020-04-23T17:44:28,697][ERROR][org.logstash.execution.ShutdownWatcherExt] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.
[2020-04-23T17:44:28,686][WARN ][org.logstash.execution.ShutdownWatcherExt] {"inflight_count"=>0, "stalling_threads_info"=>{"other"=>[{"thread_id"=>58, "name"=>"[01-beats-input]<beats", "current_call"=>"[...]/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.0.9-java/lib/logstash/inputs/beats.rb:197:in `run'"}, {"thread_id"=>50, "name"=>"[01-beats-input]>worker0", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>51, "name"=>"[01-beats-input]>worker1", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>53, "name"=>"[01-beats-input]>worker2", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}, {"thread_id"=>54, "name"=>"[01-beats-input]>worker3", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:262:in `block in start_workers'"}]}}
[2020-04-23T17:44:28,700][ERROR][org.logstash.execution.ShutdownWatcherExt] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.
[2020-04-23T17:44:28,696][ERROR][org.logstash.execution.ShutdownWatcherExt] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.
[2020-04-23T17:44:29,965][INFO ][logstash.javapipeline ] Pipeline terminated {"pipeline.id"=>"01-beats-input"}
[2020-04-23T17:44:30,035][INFO ][logstash.javapipeline ] Pipeline terminated {"pipeline.id"=>"02-local-syslog-input"}
[2020-04-23T17:44:30,074][INFO ][logstash.javapipeline ] Pipeline terminated {"pipeline.id"=>"03-secure"}
[2020-04-23T17:44:30,257][INFO ][logstash.javapipeline ] Pipeline terminated {"pipeline.id"=>"30-elasticsearch-output"}
[2020-04-23T17:44:30,929][INFO ][logstash.runner ] Logstash shut down.